ML20134J711
| ML20134J711 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 11/04/1996 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20134J709 | List: |
| References | |
| 50-302-96-12, NUDOCS 9611180005 | |
| Download: ML20134J711 (15) | |
See also: IR 05000302/1996012
Text
.
1 .
.
U.S. NUCLEAR REGULATORY COMMISSION
REGION 2 l
l
Docket No: 50-302
License No: DPR-72 i
Report No: 50-302/96-12
Licensee: Florida Power Corporation
i
Facility: Crystal River 3 Nuclear Station ;
1
Location: 15760 West Power Line Street
Crystal River. FL 34428-6708
!
I
Dates: August 26 through October 11. 1996
Inspectors: E. Girard. Reactor Inspector
P. Harmon. Reactor Engineer
R. Schin. Reactor Inspector
Approved by: C. Casto. Chief
Engineering Branch
Division of Reactor Safety
l
i
l
Enclosure
l
l
! 9611180005 961104
l PDR ADOCK 05000302
G PDR
.
.
EXECUTIVE SUMMARY
Crystal River 3 Nuclear Station
NRC Inspection Report 50-302/96-12
This special inspection included as)ects of licensee operations and
engineering. The report includes t1e results of announced inspections by
three inspectors at different times during a seven-week period. The purpose
of the inspection was to follow up on URI 50-302/96-201-08. Acceptability of
EDG Surveillance Test Values. The URI identified potential Emergency Diesel
Generator (EDG) loading issues which resulted from an Emergency Feedwater
(EFW) System modification and a related EDG operating procedure revision that
were implemented at the facility during the recent refueling outage in April -
May 1996.
Operations
The Operations procedures used during a simulator demonstration were adequate
to provide guidance during postulated Loss of Offsite Power events. Training
personnel were conversant with the Emergency Procedures. Abnormal Procedures,
and the procedure transition process. Control room operators were adequately
trained to perform the manual operations described in the procedures.
(paragraph 03)
Enaineerina
An unresolved item (URI 50-302/96-12-01) was opened to follow up on an EFW
pump net positive suction head (NPSH) problem, wherein a postulated event
concurrent with a single equipment failure could result in a low NPSH for both
EFW pumps. (paragraph E8)
An apparent violation (EEI 50-302/96-12-02) with three examples was identified
where 10 CFR 50.59 safety evaluations for one plant modification and two
operating procedure changes failed to identify the introduction of Unreviewed
Safety Questions related to increased EDG loading. (paragraph E8)
An apparent violation (EEI 50-302/96-12-03) with two examples was identified
where corrective actions were inadequate both prior to, and after, the plant
modification in April 1996 that inappropriately introduced Unreviewed Safety
Questions related to EDG loading. (paragraph E8)
An apparent violation (EEI 50-302/96-12-04) was identified where an
engineering procedure improperly allowed the general use of unverified
electrical system calculations, hydraulic system calculations, and station
blackout calculations to su) port the design, installation, and use of plant
modifications. (paragraph E8)
A weakness was identified in licensee self assessments. An engineering self
assessment dated April 9,1996, was-ineffective in that it had resulted in no
corrective actions or improvements as of October 11, 1996. Managers had not
responded to the self assessment report. Also, the report failed to reach
appropriate conclusions and the-findings of the report were not sufficiently
highlighted clear, or conclusive to support prompt responsive actions. In
addition, the licensee had provided no guidance or training for conducting
self assessments. (paragraph E8)
. . _ . . . - . _ -. .
.
. i
l
Report Details
l
Backaround
'
The inspectors followed up on URI 50-302/96-201-08. Acceptability of Emergency
Diesel Generator (EDG) Surveillance Test Values. The URI noted that Procedure
AP-770, Emergency Diesel Generator Actuation. indicated a different set of KW
ratings for the EDGs than the ratings given in the Final Safety Analysis
Report (FSAR). Tables 8.1 and 8.2. A resulting concern was that the EDG
loading could exceed surveillance test values specified in the Technical
Specifications (TS). Also, transient loading of the EDGs could exceed the
manufacturer's rating.
L. Doerations
03 Operations Procedures and Documentation l
a. Insoection Scoce (IP 92901)
l
In view of the marginal capacity of the EDGs. the inspector reviewed !
operating procedures that addressed EDG load management and observed
operator performance of those procedures on the simulator. The
inspector assessed the adequacy of operating procedures and control room
instrumentation for preventing EDG overloading during an event i
concurrent with a loss of offsite power.
b. Observations and Findinas
The inspector witnessed demonstrations on the Crystal River simulator
using Procedure AP-770. Emergency Diesel Generator Actuation. Rev. 21.
dated May 2, 1996. This procedure contained the necessary instructions i
to the operators to allow manual loading of the EDGs during emergency
situations. The procedure also contained a table listing the worst-case
KW values of the various emergency equipment. Procedure AP-770
incorporated the new load information developed for a related plant
modification that was installed during the April - May 1996 refueling
outage. The instructors performed scenarios requested by the inspector
and were able to use the procedure effectively. The instructors
demonstrated an emergency start. Loss of Offsite Power (LOOP), tripping
of a high pressure injection (HPI) pump, and restoration of the pump
using the procedure. This required transitioning from the Emergency
Operating Procedure (EOP) into the Abnormal Procedure AP-770. In the
E0P, the operator was directed to check the EDG running and supplying
proper voltage and frequency and then to verify that the ] roper loads
were connected. If a recuired load was not connected or lad trip)ed,
the operator was directec to the Abnormal Procedure. Transition Jetween
the procedures was outlined in an Operations Study Book (0SB) an on-
shift training guide.
.- --- --- --.- -.-.- - _ . . . . . - - . . . .. - -.__-.- _. -
.
- !
.
i
2 :
c. Conclusions
Procedure AP-770 contained adequate guidance to direct the operator .
re-energize tripped ecuipment onto a loaded EDG during LOOP events. .ne :
OSB guidance furnishec to the operators was adequate to guide procedure
l
transitions. Instrumentation and control features appeared sufficient
to perform the evolutions directed by the procedure
JL Enaineerina
E8 Miscellaneous Engineering Issues
E8.1 (Closed) URI 50-302/96-201-08. AcceotabilitY of EDG Surveillance Test
Values
a. Insoection Scooe (IP 92903)
Procedure AP-770. Rev. 21, and related modification MAR 96-04-12-01,
"ASV-204 EFIC Auto Open Removal," were implemented in April and May.
1996, in response to a licensee-identified potential single failure
vulnerability of the EFW system. The procedure revision and
modification resulted in the potential for increased loading of the A
EDG during a design basis accident concurrent with a single equipment
failure. The inspectors followed up on the concern with the increased
EDG loading and reviewed potential
barriers that may have contributedtorelated problems breakdowns
with EDG loading. in processes or
The inspectors reviewed the completed modification package, including
the 10 CFR 50.59 safety evaluation that was performed to determine
whether the modification could be implemented without receiving prior
approval from the NRC. Also, the inspect - s interviewed the engineers
involved in the modification and several reviewers of the MAR and the
'
procedure revision. In addition, the inspectors reviewed related
processes and barriers tnat might have failed to prevent the
inappropriate introduction of Unreviewed Safety Questions related to EDG
.
l
,
loading.
,
b. Observations and Findinas
1) Modification MAR 96-04-12- and Related EDG Loadina Unreviewed Safety
Questions
The purpose of MAR 96-04-12-01 "ASV-204 EFIC Auto Open Removal," and
the related Rev. 21 to AP-770 was to prevent a potential single failure
vulnerability to the EFW system. The single failure vulnerability, that
the licensee had identified in March 1996, involved EFW being called !
- - upon to actuate automatically, concurrent with a' LOOP and a single '
failure of the B train vital DC power. In that event, the turbine-
,
driven EFW pump would start (one of the two parallel steam su) ply i
i
valves. ASV-204, which was powered from the A train of vital )C power, i
would open) and the pump's discharge flow control valves would fail l
!
t-
-, . - - , . . - . . . .,.- -,- _,
._ .- . . - - . . - . - -
,
.
.
3
l fully open (due to the loss of B train vital DC power to them). As a
l result, the turbine-driven EFW pump would operate at its maximum
capacity while the motor-driven EFW pump was also o)erating. This could
cause a low NPSH in the common suction pi)e for bot 1 EFW pumps and
potentially challenge the operability of )oth EFW pumps,
MAR 96-04-12-01 changed the EFIC logic to remove the automatic opening
of ASV-204. The other parallel steam admission valve (ASV-5), for the
turbine-driven EFW pump, received DC actuating power from the B train of
,
vital DC power. Thus, both before and after the modification, during a
I transient where EFW was called upon to initiate and with no equipment
failures, both the motor- and turbine-driven EFW pumps would start and
l both pumps would pump water into both OTSGs. However, after the
modification, in an event where EFW were called upon to initiate '
r concurrent with a failure of the B train vital DC Jower, the turbine-
driven EFW Jum) would not start. In this event, t1ere would be no
l problem wit 1 t1e NPSH for the motor-driven EFW pump. However, the
l motor-driven Jump would need to pump more water and thus, if there were
I a concurrent _00P. would represent a larger KW load on the A EDG. Note
that in this event, the B EDG would not be available as its output
breaker would not have B train vital DC power and thus would not close.
l
l Well into a design-basis event (with a LOOP and a failure of the B train
l vital DC power), the E0Ps required operators to start additional loads
i which could overload the A EDG. The revision to Procedure AP-770
.
addressed this problem by providing procedural guidance for operators to
l close the turbine-driven EFW pump discharge block valve manually, open
the EFW pumps' discharge cross-tie valves, and start the turbine-driven
EFW pump (by manually opening valve ASV-204). This would allow the
I turbine-driven EFW pump to use the A train EFW flow control valves,
which would have power.
In October 1996, with the unit shut down for secondary plant ;
maintenance, the licensee recognized that MAR 96-04-12-01 had not ;
resolved the potential single failure problem. A design-basis event !
! with a LOOP and a single failure of power to the turbine-driven EFW l
pum)'s discharge flow control valves would result in the same NPSH
pro)1em that the modification was supposed to prevent. The inspector
noted that the licensee had not reported the EFW NPSH issue to the NRC.
Also, other B&W units had years ago installed flow limiting venturies in
.
'
r
'
the EFW system and Crystal River had not. The licensee decided to keep ;
the unit shut down voluntarily until the NPSH problem was fully analyzed !
and resolved. Further NRC review of the EFW NPSH issue is needed: this
includes safety significance (effect on operability), when and how the
design deficiency was introduced, when and how it became known by the
licensee, corrective actions taken by the licensee, reportability of the
- issue, and any prior notice to the licensee of this design deficiency.
4 URI 50-302/96-12-01, EFW NPSH Issue, is opened to track further NRC
review of this issue.
'
The inspector reviewed the licensee EDG loading calculations that were
performed in April 1996 to support the modification and procedure
l
l
l
.- . - .- . . - - . . - - _ _ _ - - - . .- - - ~ ..
.
.
.
'
4
revision. The calculations showed that the modification increased the
)otential loading of the A EDG such that the design load limit of 3500
.
'
(W would be exceeded for short periods of one to three seconds during
certain EDG block loadings. The 3500 KW limit was specified by TS Basis B 3.8.1 and by FSAR Chapter 8.2.3. The modification also caused the
automatically connected accident load at the one-minute interval to be l
increased to approximately 3159 KW. This was in excess of the minimum
test load specified by TS Surveillance Requirement 3.8.1.11. which
specified a periodic surveillance (24 month interval) of the EDG loaded
to between 3100 and 3250 KW for 60 minutes. The TS Basis for the
l surveillance stated that the " minimum load of 3100 KW provides margin
above the predicted worst-case automatically connected accident load at.
'
one minute." In addition, the modification increased the motor-driven
, EFW pump load to 666 KW. which exceeded the TS Surveillance Requirement
!
Basis 3.8.1.8 statement that the largest single post-accident load (that
the A EDG would have to reject) was 616 KW. The inspector concluded
, thet the exceeding of these three TS limits inappro)riately reduced the
i
margin of safety as defined in the TS Bases: and, t1erefore, introduced
- three unreviewed safety questions.
'
The question of the acceptability of the surveillance test values was
originally identified during the Crystal River Integrated Performance
Assessment Process team inspection as URI 50-302/96-201-08.
l Acceptability of EDG Surveillance Test Values. The inspector verified
!
that the licensee performed the specified surveillance on A)ril 30.
I 1996. The EDG was loaded to ap)roximately 3179 KW: 20 KW a)ove the new
l'
one-minute value. Therefore, t1e inspector concluded that the licensee
had a surveillance test in effect that demonstrated the EDG's ability to
operate with the maximum calculated one-minute loads.
The licensee researched the origin of the one-minute /3100 KW
surveillance requirement. The surveillance was intended to verify EDG
load-carrying capability for what was assumed to be the highest demand
period: the first few seconds, when block loads are automatically
connected to the EDG bus, and their resultant starting loads. In the.
j original TS. the initial block loading was assumed to be complete by the
'
end of the first 60 seconds, when the load would be essentially stable.
The earliest design / licensing documents the inspector reviewed
stipulated a surveillance of at least 2750 KW. This value was changed ,
and reviewed by a SER dated September 24, 1990, to the present value of i
,
3100 KW. Testing the EDG for at least 60 minutes at a value above the ;
! expected loads ensured that cooling and lubrication were adequate for
j extended periods of operation for the worst case loading value. Since
then, the plant has been modified such that block loads were still being
applied well past the one-minute time frame, and the one-minute loads,
originally less than 2750 KW, had increased to 3179 and 3158 KW for EDG
A and B. respectively.
!
, The modification and its attendant EDG load increase also caused the
maximum load limit to be exceeded. This limit was referenced in both
,
FSAR Chapter 3.2.3 and TS Basis B 3.8.1. Both sources stipulated that
the service rating of the EDG was for a cumulative (30 minutes total)
,
. _ _ _ _ . _ _ _ _ _ _ . - _ _ . _ _ _ _ _ _ _ - . _ . _ _ . . _ _ _ _
.
-
.
5
loading of 3250 to 3500 KW. Lower loads (e.g 3001 to 3250 KW for 200
hours total) allow cumulative run times of longer duration. There were
no provisions in either source for loads above 3500 KW for any amount of
time.
The engineering review performed for the modification recognized that
the upper limit of 3500 KW would be exceeded during loadings for certain
accident scenarios. The loads were assumed and calculated to occur in
blocks ap) lied at 5 second intervals, for a total of 6 blocks (plus time
for the EXi voltage and frequency to stabilize) within the first 60
seconds. The worst case loading scenario was a composite of the
calculated maximum EDG loads for those scenarios. This composite showed
loads above 3500 KW in two instances during the first minute. At 25
seconds, a peak load of 3696 KW with a duration of one second was shown,
and at 53 seconds a peak of 3651 KW with a duration of ap3roximately 2.5
seconds was calculated. Other smaller loads (above 3100 aut less than
3250 KW) occurred as late as one hour into the composite scenario.
On April 10. 1996. Engineering contacted the EDG vendor: Coltech. Inc.: i
to request assurance that the high. short-duration loading peaks would '
not have an adverse impact on the EDG unit. The vendor responded, on
April 17 that the "one-time excursion of 3500 to 3700 KW for up to two
seconds is not expected to have an adverse effect on the Genset (diesel
generator set)". On April 24. Engineering again contacted the vendor
for more specific assurance that several blocks (designated as Blocks 4
5. and 6) calculated to have loads in excess of 3500 KW were still
acceptable. Coltech responded, by letter dated April 25. that the
" event" identified was a "one-time" event and was not expected to have i
an adverse effect on the diesel generator. j
The second Coltech letter was telefaxed to Crystal River on April 25.
l The next day. April 26. all reviewers signed off on MAR 96-04-12-01.-the
controlling document for this modification. The MAR included a 10 CFR
50.59 screening and evaluation for the modification. The engineer who
performed the screening form incorrectly answered two of the three
screening questions. Question #2 asks: "Does this change affect the TS l
Bases?". Question #3 asks: "Does this change involve changes to the -
Technical Specifications?". Both were answered "No" by the preparer.
l Question #1. "Is this a change to the facility as described in the
FSAR?" was correctly answered "Yes". The screening criteria is that any i
one of the questions answered "Yes" requires a 10 CFR 50.59 evaluation !
prior to implementation.
L
The full 10 CFR 50.59 evaluation asks similar questions. In this case,
the same individual who prepared the screening form also incorrectly
answered question #7 incorrectly. The question. "Is the margin of i
o safety as defined in the basis for any TS reduced?" was marked "No". l
, Crystal River has not implemented a value below the design or license
limit below which load increases to the EDG can be implemented without
c " decreasing the margin of safety" Therefore, a reduction in margin to
the limit (and exceeding the limit for a brief time) was a reduction of
~
i the margin of safety. This should have required Question #7 to be '
l-
,
'
. . _ _ - . _ _ _ _- . - - . _ _ _
_ _ _ _ - _ _. _ _ ._.-._ - _.._. _ _ _ _ _ ._ _ _ - _ - _. _ .-
,
'
.
i
\
!
6
i
l- marked "Yes". Marking any of the Questions "Yes" is a determinant that !
an Unreviewed Safety Question is involved with the change, requiring i
prior NRC approval of the modification. !
,
The inspector reviewed the MAR and the attached documents in the !
l package. Although the preparer of the 10 CFR 50.59 evaluation noted !
l references he consulted in both the TS and FSAR. copies of the actual
l documents were not supplied in the MAR package. The MAR preparer did -
not reference the EDG load requirements from either TS or FSAR in the 10 1
CFR 50.59 evaluation. He only referenced the Emergency Feedwater TS and j
FSAR sections. There is no record of any of the several reviewers l
. questioning the conclusions of the 10 CFR 50.59 evaluation. Since the
actual FSAR and TS Jages were not part of the MAR package, there is no j
L clear record that t1e reviewers consulted the actual documents, i
i In summary: the licensee's EDG loading calculation analysis had !
j recognized that.the calculated EDG loading exceeded the values stated in l
l the TS Bases but did not recognize that this reduced the margin of i
i
safety as described in the TS Bases. Consequently, the licensee did not
recognize that US0s were introduced. Based on correspondence with the '
EDG vendor, the licensee's loading calculation analysis concluded that
the EDG could safely handle the increased loading. Also, the licensee
had verified that the most recent surveillance test had tested the load 1
rejection ability of the EDG at greater than 666 KW. The modification
package for MAR 96-04-12-01 had been independently verified by an- I
engineer other than the one who prepared the MAR: reviewed by a l
l technical support engineer, a senior reactor operator, an environmental f
l qualification reviewer, an engineering su]ervisor, and the.PRC: and
! approved by the nuclear plant manager. T1e inspector noted that the MAR i
package did not include the EDG loading calculation analysis. Also, the l
licensee's 10 CFR 50.59 safety analysis of the modification, which was
'
r
i
included in the MAR package, did not address the increase in EDG loading i
and consecuently did not recognize the US0s and the need to obtain NRC
review anc approval prior to im)1ementing the modification. This ;
inappropriate introduction of t1ree US0s regarding EDG loading is an
apparent violation of the requirements of 10 CFR 50.59. This issue is -
identified as the first example of EEI 50-302/96-12-02. EDG Loading
i: US0s. URI 50-302/96-201-08 is closed.
2) Corrective Actions Related to MAR 96-04-12-01-Unreviewed Safety
Questions
After MAR 96-04-12-01 was installed, the licensee identified that it had
introduced )otential problems with EDG loading. On May 31. 1996, a
member of tie plant staff wrote Precursor Card 96-2750. identifying that '
"the EDGs will exceed 3500 KW while loading blocks 4. 5. and 6. Also.
l the running load exceeds 3000 KW. The letter obtained from the vendor
- (Coltech) appears to not meet the FSAR ... and TS Bases." The Precursor
l Card system is the vehicle for entry-level problem reporting. This
!
particular Precursor Card was reviewed and a determination was made that
-
" Engineering had already analyzed this and were preparing changes to the
i FSAR and the design basis (EDBD)". This response does not address the
.- -- , -
-. . - -
- . - .
- - - - - -. . - - -- . . . . .
.
!-
l
7
l
l concern directly, but only states that Engineering was aware of the
- inconsistency.
l
l On July 2. 1996, another Precursor Card. 96-3192 was written to the
effect that the 10 CFR 50.59 screenings and safety evaluations for many
modifications had failed to address the tabulated EDG loads listed in
FSAR tables 8-1 and 8-2. The problem was acknowledged by the reviewer,
but was described as "not a safety concern only a paperwork problem"
On July 3.1996, a higher level non-conformance Problem Report 96-0210,
was issued. This Problem Report addressed the concerns associated with
l Precursor Card 96-2750. written May 31, 1996. This higher level problem
l resolution requires more detailed evaluation and a team approach to
i disposition. The Problem Report concluded that " ...the team decided
i that a safety concern did not exist, but that the issue identified as
question five (whether the one-minute load exceeded the 3100 KW
- surveillance limit) must be resolved in a timely manner to determine if
- the EDG auto-connected load at one minute is actually greater than 3100
l KW." At that point the licensee initiated a detailed analysis to
l determine accurate load information. This study was still in process as
,
of October ll. 1996.
.
Both responses to the problem reports indicated a recognition that TS
l Bases and FSAR values were being exceeded, but there was no recognition
of a US0 being introduced.
'
Regional inspectors visited the site August 26-30. 1996, and September
9-13. 1996, and reviewed the circumstances and documentation associated
with this modification. The inspectors informed the licensee that the
modification apaeared to involve a US0 and that the 10 CFR 50.59
'
evaluation reacled an inaccurate conclusion that a US0 did not exist.
However, the licensee did not begin re-performing the 10 CFR 50.59
evaluation until after the inspectors' exit on September 13, 1996.
Subsequently, the licensee confirmed the NRC's finding that the
modification had inaapropriately introduced US0s. The US0s were not
corrected as of Octo)er 11. 1996. The inspectors concluded that the
licensee's corrective action in r.esponse to this issue was not adequate
and was an apparent violation of NRC requirements. This inadequate
corrective action is identified as the first example of EEI 50-302/96-
12-03. Inadequate Corrective Actions for 10 CFR 50.59 Evaluation Errors.
l During a subsequent review of this issue, the licensee found that the
!
corrective action for a previous similar event had been ineffective in
,
'
preventing a recurrence. Problem Report 94-0218. dated June 24, 1994.
described a problem where engineers failed to address EDG loading
effects of several modifications in the 10 CFR 50.59 evaluations. The
'
corrective action included counseling electrical and I&C design
engineers on requirements to address EDG loading effects in 50.59
evaluations. However, in MAR 96-04-12-01. EDG loading effects were not
addressed in the 50.59 evaluation. For MAR 96-04-12-01, the 50.59
preparer, reviewer, and supervisor approver were all electrical /I&C
design engineers. This ineffective corrective action is identified as
. .. - - - - .- .. .-. -.
,
.
l
l
8 l
'
the second example of EEI 50-302/96-12-03. Inadequate Corrective Actions
for 10 CFR 50.59 Evaluation Errors.
3) Ooeratino Procedure Revisions and EDG Loadina Unreviewed Safety
Questions
While reviewing EDG loading calculations, the FSAR. the TS. and the
licensee's most recent evaluation of the EDG loading issue, the
inspector noted that there were different numbers for EFW pump KW. In a
current review of EDG loading calculations operators had identified
that the motor-driven EFW pump was operated differently than assumed in
the EDG loading calculation resulting in a higher KW load on the A EDG.
Further licensee review, as requested by the inspector, found that this
different operation of the motor-driven EFW pump had originated in a
revision to an operating procedure (EOP-13. E0P Rules. Rev. 2) that was 1
made during the April - May 1996 refueling outage. The inspector
reviewed the 10 CFR 50.59 evaluation for the procedure revision and
found that it did not address a consecuent increase in EDG loading. The
procedure change increased the motor criven EFW pump post-accident load
from 666 KW to 713 KW by directing operators to take manual control and
increase EFW flow. The load increase was not reflected in the 10 CFR
50.59 evaluation and also was not considered in the April 1996 end of
outage EDG loading calculations. The resulting EDG load was greater
than that calculated to support MAR 96-04-12-01. and therefore the same
three US0s as discussed above were introduced. The inadequate 10 CFR
50.59 evaluation for E0P-13. Rev. 2. is an apparent violation of NRC
requirements. It is identified as the second example of EEI 50-302/96-
12-02. EDG Loading Unreviewed Safety Questions.
The inspector also noted that there were different numbers for HPI Pump
KW load on the A and B EDGs. Further licensee review, as requested by
the inspector, found that a revision to an operating procedure (0P-402.
Makeup and Purification System. Rev. 64. dated June 9.1990) had
,
increased the post-accident HPI pump load on the A EDG by 75 KW and on
'
the B EDG by 86 KW by allowing operators to ES select the swing B HPI
pump to either EDG. (The B HPI pump had a larger capacity and therefore
used more KW than the A or C HPI pum]s.) The inspector noted that the
load increase was not reflected in t1e 10 CFR 50.59 evaluation for the
procedure revision and also was not considered in the EDG loading
calculations. As a result. the current verified and approved A and B
EDG loading calculations, dated June 9. 1993, and the current FSAR
l included incorrect values for HPI pump loads on the EDGs. Also, the
! post-accident load of the B HPI pump (691 KW) exceeded the current TS
l Surveillance Requirement Basis 3.8.1.8 statement that the largest single
post-accident load (that the EDG could have to reject) was 616 KW. The
current TS requirement had been in effect since 1994. Prior to that,
from 1988 until the Improved Technical Specifications were incorporated
in 1994. TS Surveillance Requirement 4.8.1.2.2.d.2 required that at
least once per 18 months the EDG be tested to verify its capability to
reject a had of greater than or equal to 515 KW without tripping. The
inspector concluded that OP-402. Rev. 64. had introduced at least one
EDG loading US0 that was not recognized by the 10 CFR 50.59 safety
l
l
l
!
._ ._ _ _. _ _ - ._ _ _ ___
.
.
9
evaluation. The plant had operated with this US0 from June 1990 through
October 1996. The inadequate 10 CFR 50.59 evaluation for OP-402. Rev.
64 is an apparent violation of NRC requirements. It is identified as
the third example of EEI 50-302/96-12-02. EDG Loading Unreviewed Safety
Questions.
4) Maintenance Activities and EDG Loadina
The inspector noted that licensee procedures discussed the potential for
maintenance activities to affect EDG loading. For example, replacement
of a pump impeller could improve the pumping ability of a Jump and
increase its KW load on the EDG. The inspector inquired a)out any such
maintenance conducted recently, and found that the A HPI pump impeller
had been replaced during the April - May 1996 refueling outage. The
work had been done under a maintenance work order (a 10 CFR 50.59 safety
evaluation was not required). The pump had been tested in May, after
the impeller replacement, when its new KW was determined to be 680 (an
increase of 64 KW from the previous value of 616). The inspector noted
that this increase did not change EDG loading calculations. as they
already assumed a maximum HPI pump load on each EDG of 691 KW from the B
HPI Jump (operators were allowed to select either the A or B HPI aump to
be t1e A train ES Jump and either the C or the B HPI pump to be t1e B
train ES pump). T1e inspector also found that the new A HPI pump load
of 680 KW was appropriately included in the EDG loading calculation
data. The inspector concluded that, in this case, the maintenance
activity did not increase EDG loading and in that respect was not a
change to the facility. Nonetheless, the inspector noted that a
maintenance activity that resulted in an increase in EDG loading could
be considered a change to the facility. Consequently, the prior use of
a 10 CFR 50.59 safety evaluation would be conservative and appropriate.
5) Unverified Calculations
.
While reviewing the EDG loading calculation and analysis that supported
MAR 96-04-12-01. which was performed under REA 96-047, the inspector
noted that there was no signature for independent verification of the
calculation or related analysis. After further inquiry and review the
inspector found that the calculation had not been independently
veri fied. Further. Engineering Procedure NEP-210. Modification Approval
Records. Rev. 15. dated January 16. 1996, allowed unverified
calculations to be relied upon to support MAR installation and return to
service. As a result. REA 96-047. EDG Loading Case Study, which was not
verified, was used to support MAR 96-04-12-01 approval in April 1996.
The REA analysis was complex - it included a computer run of about 1600
- pages and a detailed analysis of EDG loading effects of the
i
modification; and it incorrectly concluded that the MAR introduced no
i problems with EDG loading (the three US0s discussed above were later
,
identi fied) .
During subsequent verification / review of EDG loading calculations in
October 1996, operators found that an EDG loading assumption was
incorrect and nonconservative. The assumption that the post-accident
l
.
'
.
10
load of the motor driven EFW pump would be 666 KW with the pump in
automatic was incorrect - per E0Ps, operators would operate the pump in
manual at higher flows. resulting in a load of 713 KW. Had o)erators
reviewed the REA 96-047 EDG loading analysis in April 1996, t1ey likely
would have identified this error before the modification was installed
and placed in service.
The inspector found that the latest verified EDG loading calculation was
dated June 9. 1993. Two refueling outages with modifications, procedure
changes, and maintenance activities that affected EDG loading had
occurred since then. Also, the licensee currently had only one engineer
who knew how to perform EDG loading calculations.
Procedure NEP-210 inappropriately exempted electrical system
calculations, hydraulic system calculations, and SB0 calculations from
verification when they were used to support modifications. As a result,
the licensee may have relied on many unverified calculations to support
modifications that were installed and operated. The fact that NEP-210
inappropriately allowed unverified calculations to be relied upon for
the design, installation, and operation of modifications to safety-
related ecuipment is an apparent violation of NRC requirements. It is
identifiec as EEI 50-302/96-12-04. Use of Unverified Calculations to
Support Modifications.
6) Enaineerina Self Assessment
During the inspection of EDG loading issues, the inspector reviewed a
related licensee self assessment. An engineering self assessment
report. " Nuclear Engineering and Projects Self Assessment:
Interdisciplinary -Interface Effectiveness." dated April 19, 1996, had
identified that NEP-210 and Al-410 requirements for verification of
Requests for Engineering Assistance may not comply with regulatory
requirements. However, the report failed to conclLie whether there was
a violation of regulatory requirements or not. The inspector concluded
that the licensee had failed to pursue the issue appropriately in order
to reach-a conclusion. The licensee had not initiated any corrective
action on this issue and also had not initiated any improvements in
response to the report as of October 11, 1996. The inspector concluded
that, since engineering managers had not acted upon the self assessment,
it had been ineffective.
The inspector reviewed the entire report and noted that the report had
only- three recommendations: .which were not in the front of the report
but instead were located on page 13. Also the recommendations were not
sufficiently clear or conclusive to support prompt responsive actions.
-The inspector observed that the engineer who was a principal contributor
to the report was appareatly discouraged that he had received no
feedback on the report vom engineering management. Also, the licensee !
had provided no guidance or training on conducting self assessments to
the engineer. The ins)ector concluded that the ineffectiveness of this
-
report indicated a weacness in licensee self assessment.
1
!
__ _ _. - . . . , , _!
. .
.
.
11 !
c. Conclusions
The inspectors opened an unresolved item (URI 50-302/96-12-01) to follow i
up on an Emergency Feedwater (EFW) pump net positive suction head (NPSH)
problem, wherein a postulated event concurrent with a single equipment
failure could result in a low NPSH for both EFW pumps.
The inspectors identified an apparent violation (EEI 50-302/96-12-02)
with three examples, where 10 CFR 50.59 safety evaluations for one plant
modification and two operating procedure revisions failed to identify
the introduction of Unreviewed Safety Questions related to increased EDG
loading.
Ins)ectors also identified an apparent violation (EEI 50-302/96-12-03)
wit 1 two examples, where corrective actions for 10 CFR 50.59 evaluations
were inadequate both prior to and after the plant modification in April
1996 that inappropriately introduced Unreviewed Safety Questions related
to EDG loading.
In addition, inspectors identified an apparent violation (EEI 50-302/96-
12-04) where an engineering procedure improperly allowed the general use
of unverified electrical system calculations, hydraulic system
calculations, and station blackout calculations to support the design,
installation, and use of plant modifications.
Also, inspectors identified a weakness in licensee self assessments. An
engineering self assessment dated April 9,1996, was. ineffective in that
it had resulted in no corrective actions or improvements as of October
11. 1996. Managers had not res)onded to the self assessment report.
Also, the report failed to reac1 appropriate conclusions and the
findings of the report were not sufficiently hignlighted, clear, or
conclusive to support prompt responsive actions. In addition, the
licensee had provided no guidance or training for conducting self
assessments.
i
III. Manaaement Meetinas l
!
X1 Exit Meeting Summary ;
Th'e inspection scope and interim findings were summarized on September
13. 1996: and final findings were summarized on October 11, 1996. The ,
inspectors described the areas inspected and discussed in detail the !
inspection results listed below. Proprietary information is not ,
contained in this report. Dissenting comments were not received from i
the licensee. ;
l
I
_ _ _ . _ __.._____m._- ._
_ _ . _ . _ _ _ . _ _ . . ,
-
!
-
.
-l
'
!
12 !
PARTIAL LIST OF PERSONS CONTACTED l
i
Licensee
K. Baker Manager Nuclear Configuration Management
l
i
D. Bates. Manager. Quality Systems i
'
P. Beard. Senior Vice President Nuclear Operations
G. Becker. Operations
G. Boldt. Vice President. Nuclear Production t
B. Gutherman, Manager, Nuclear Licensing
G. Halnon Manager Nuclear Licensing
L. Kelley. Director Nuclear Operations Site Support i
,
P. McKee Director. Quality Programs )
l R. McLaughlin. Nuclear Regulatory Specialist l
F. Sullivan. Manager. Nuclear Engineering Design :
D. Wilder Manager Radiation Protection
NRC
R. Butcher. Senior Resident Inspector
T. Coo)er Resident Inspector
l L. Raglavan Project Manager
INSPECTION PROCEDURES USED
IP 92901: Followup - Operations
IP 92903: Followup - Engineering
ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
Type Item Number Status Descriotion and Reference
URI 50-302/96-12-01 Open EFW NPSH Issue (paragraph E8.1.b.1)
EEI 50-302/95-12-02 Open. EDG Loading US0s: Three Examples
(paragraphs E.8.1.b.1 and E.8.1.b.3)
EEI 50-302/96-12-03 Open Inadequate Corrective Actions for 10
CFR 50.59 Evaluation Errors: Two ,
i Examples (paragraph E.8.1.b.2) !
- EEI 50-302/96-12-04 Open Use of Unverified Calculations to ,
l Support Modifications (paragraph I
l E.8.1.b.5)
! !
l l
_. _ _
_ _ _ __ - _ __
,
-
.
13
Closed t
Typ_e Item Number Status Descriotion and Reference
URI 50-302/96-201-08 Closed Acceptability of EDG Surveillance
Values (paragraph E.8.1.b.1)
,
,
LIST OF ACRONYMS USED I
AI - Administrative Instruction
CFR - Code of Federal Regulations !
CR3 - Crystal River Unit 3 i
EA - Enforcement Action
EDBD - Enhanced Design Basis Document
EDG - Emergency Diesel Generator
EEI - Escalation Enforcement Item
EFIC - Emergency Feedwater Initiation and Control
EGDG - Emergency Diesel Generators <
E0P - Emergency Operating Procedure
ES - Engineered Safeguards
FPC - Florida Power Corporation
'
FSAR - Final Safety Analysis Report
HPI - High Pressure Injection
I&C - Instrumentation and Control
IP - Inspection Procedure
KW - Kilowatt
LOOP - Loss of Offsite Power
MAR - Modification Approval Record
NEP - Nuclear Engineering Procedure
NOV - Notice of Violation :
NPSH - Net Positive Suction Head l
i NRC - Nuclear Regulatory Commission
!
OP - Operating Procedure
OTSG - Once Through Steam Generator i
PR - Problem Report
PRC - Plant Review Committee
l REA - Request for Engineering Assistance )
'
580 - Station Blackout '
SER - (NRC) Safety Evaluation Report l
SR - Surveillance Requirement
SRO - Senior Reactor Operator
i
TS - Technical Specification
i URI - Unresolved Item
USQ - Unreviewed Safety Question
1
l
l
l
!